Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Cisco patches exploited ASA and FTD SSL VPN crash flaw

9 sources · 10 articlesFirst reported Updated ()1
What's new

October 30: Security Affairs confirms CISA’s KEV listing and the November 1 federal deadline, adding no new Cisco technical details.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Cisco has fixed actively exploited CVE-2026-76418; CISA’s federal deadline is November 1, 2026.

Cisco released fixes on October 28, 2026, for CVE-2026-76418, a CVSS 8.6 denial-of-service flaw in Remote Access SSL VPN on Secure Firewall ASA and Threat Defense. An unauthenticated attacker can send a crafted connection and reload the device when secondary authentication is set on a tunnel group and SSL VPN is enabled; a successful login is not required. Cisco’s PSIRT found exploitation in October after a TAC case, reported no confirmed data theft or code execution, and named no attackers or scale. CISA added the flaw to the Known Exploited Vulnerabilities catalog, with a November 1, 2026, federal deadline and unknown ransomware use. There is no full workaround. Most outlets list ASA 9.23.1.48 as fixed; the Canadian Cyber Centre lists 9.23.1.4.

Key facts
  • CVSS 8.6 NULL-pointer or logic error causes an unexpected reload.
  • ASA fixes include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.24.1.27, and 9.24.10.1.
  • FTD fixes include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
  • Secure FMC, cloud firewalls, and Secure Access are not affected.
  • Shadowserver tracks more than 51,000 exposed ASA SSL VPN devices, patch status unknown.
  • SecurityWeek calls it the second ASA/FTD SSL VPN DoS zero-day since August CVE-2026-20349.
Analyze CVE-2026-97229 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Aug 1, 2026Earlier ASA and FTD SSL VPN DoS zero-day disclosed · SecurityWeek
  2. Oct 28, 2026Cisco publishes fixes after finding October exploitation · Cyber Security News
  3. Oct 29, 2026CISA adds CVE-2026-76418 to KEV catalog · CISA Known Exploited Vulnerabilities
  4. Nov 1, 2026Federal agencies’ mitigation deadline under BOD 26-04 · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts
  • CISA Known Exploited VulnerabilitiesSets November 1 federal deadline; ransomware use unknown.
  • SecurityWeekCredits Eric Fernald; second SSL VPN DoS zero-day since August.
  • BleepingComputerShadowserver sees more than 51,000 exposed ASA SSL VPN devices.
  • Canadian Centre for Cyber SecurityLists affected ASA 9.23 builds before 9.23.1.4, not 9.23.1.48.
  • CSO OnlineDisabling the tunnel-group list leaves the default group exposed.
CVEs
CVE-2026-97229CVE-2026-76418CVE-2026-20127
Vendors
GitLabCisco
Products
GitLab Community EditionGitLab Enterprise EditionCisco Secure Firewall ASACisco Secure Firewall FTDSecure Firewall Adaptive Security ApplianceSecure Firewall Threat DefenseSecure Firewall ASA SoftwareSecure Firewall Threat Defense SoftwareSD-WAN Catalyst ControllerAdaptive Security ApplianceThreat DefenseSecure Firewall ASA
Threat actors
UAT-11473Volt Typhoon
Malware
KeyDriftPolyFlameLittleFilch
Victims
Alpine Linux
Organizations
CISACisco TalosShadowserverCisco PSIRT
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 1d ago CISA Known Exploited VulnerabilitiesFirst report

    CISA KEV lists Cisco firewall DoS flaw CVE-2026-76418

    Unauthenticated remote attackers can reload ASA and Secure FTD devices; the federal due date is November 1, 2026.

  2. · 1d ago Cyber Security News

    Cisco Secure Firewall VPN flaw CVE-2026-76418 exploited to crash devices

    Unauthenticated crafted requests reload ASA and FTD devices when SSL VPN secondary authentication is configured; CVSS is 8.6.

  3. · 1d ago GBHackers

    Cisco patches exploited ASA and FTD SSL VPN flaw CVE-2026-76418

    Unauthenticated crafted VPN requests can reload firewalls; CVSS is 8.6 and there is no workaround.

  4. · 1d ago SecurityWeek

    Cisco patches exploited ASA and FTD SSL VPN zero-day

    CVE-2026-76418, CVSS 8.6, lets unauthenticated attackers restart firewalls when secondary authentication is configured.

  5. · 1d ago The Hacker News

    Cisco patches actively exploited ASA and FTD VPN crash flaw

    CVE-2026-76418, scored 8.6, lets unauthenticated attackers reload firewalls when SSL VPN uses secondary authentication.

  6. · 1d ago BleepingComputer

    Cisco ASA and FTD SSL VPN zero-day crashed firewalls in attacks

    Unauthenticated attackers can reload devices that have webvpn and SSL VPN enabled; Cisco found exploitation in October 2026.

  7. · 1d ago Canadian Centre for Cyber Security

    Cisco says CVE-2026-76418 in Secure Firewall is exploited in the wild

    ASA and FTD releases before the listed builds are affected by a remote SSL VPN tunnel denial of service.

  8. · 1d ago CSO Online

    Cisco ASA and FTD SSL VPN flaw exploited to crash devices

    CVE-2026-76418, scored 8.6, lets an unauthenticated attacker reload ASA or FTD when secondary authentication is configured; Cisco has fixes but no workaround.

  9. · 14h ago The Hacker News

    CISA adds exploited GitLab RCE and Cisco firewall DoS to KEV

    Federal civilian agencies are told to apply fixes for both flaws by November 1, 2026.

  10. · 1h ago Security Affairs

    CISA adds exploited GitLab and Cisco firewall flaws to KEV

    Federal agencies must fix unauthenticated GitLab code execution and a Cisco firewall reload bug by November 1, 2026.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-20127
Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
10.089%KEV
KEV
CVE-2026-76418
Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
8.6<1%KEV
KEV
CVE-2026-97229
Unauthenticated RCE in GitLab CE/EE via CI/CD regex
10.018%KEVPoC ×5
KEV